Privacy-Preserving RAG by Concealing Sensitive Information from External LLMs

2026-08-12

AI Summary

This work addresses the privacy risks posed by external large language models (LLMs) in retrieval-augmented generation (RAG), where sensitive information from user queries and retrieved documents may be inadvertently exposed. To mitigate this, the authors propose SEAG, a novel framework that prevents external generators from directly accessing sensitive data through an end-to-end, lightweight entity anonymization mechanism. SEAG employs a small model to identify sensitive entities, generate aliases, and construct a substitution table, which is then used to sanitize both queries and retrieved documents before they are passed to the external LLM. The approach effectively balances privacy preservation with downstream task accuracy, achieving over 80% user-oriented accuracy across mainstream models (Qwen-3, LLaMA-3.2, and Phi-4) and attaining strong performance—77.83%, 76.73%, and 74.91% respectively—in fully masking all sensitive entities.

Abstract

Retrieval-Augmented Generation (RAG) is widely used to improve the performance of Large Language Models (LLMs) in answering user queries. Existing privacy research on RAG has focused on preventing unauthorized users from accessing sensitive data. However, another important problem that is often overlooked in RAG privacy research is that external generators have access to the query and the retrieved documents, which may contain confidential information that could potentially be misused or accessed for unintended purposes. In this paper, we introduce the Sensitive Entity Alias Generator (SEAG), a privacy-preserving framework that empowers users to utilize powerful third-party generators without disclosing sensitive information. SEAG introduces a lightweight model that locates sensitive entities, generates corresponding aliases, and constructs an entity replacement table. The table is used to replace sensitive words in the user's query and in the retrieved documents before they are forwarded to an external generator. For this purpose, two datasets were constructed: one for fine-tuning SEAG models to generate entity replacement tables, and another for evaluating the entire SEAG framework. The experimental results demonstrate the success of the SEAG framework. As for the User metric, which measures the ability of the model to provide a correct response to the user while hiding sensitive information from the external generator, all SEAG models achieved over 80% accuracy. Additional analysis further evaluated the ability of SEAG models Qwen-3, LLaMA-3.2, and Phi-4 to hide all sensitive entities within given documents. The results show good performance with total accuracies of 77.83%, 76.73%, and 74.91%, respectively.

Problem

• Privacy-Preserving RAG
• Sensitive Information
• External LLMs
• Confidential Data
• Information Concealment

Innovation

• Privacy-Preserving RAG
• Sensitive Entity Alias Generator
• Entity Replacement
• External LLM Privacy
• Retrieval-Augmented Generation